EvidenceLock SIFT demo

Watch the verifier reject an unsupported finding, then accept the corrected proof trace.

This narrated demo is generated from public project assets only. It shows the judge path for FIND EVIL: run the vertical slice, inspect the proof card, verify the manifest, and check the honest SIFT boundary.

What To Watch

  1. First verifier pass catches unsupported confirmed claims.
  2. Corrected report cites exact evidence IDs and tool-call IDs.
  3. Integrity manifest verifies the published report hashes.
  4. Negative control downgrades no-evidence claims to unresolved.

One Command

Judges can reproduce the core proof without accounts, keys, or private data.

export PYTHONPATH=src python3 tools/judge_smoke_test.py

Safety Boundary

Proven now: normalized Windows EVTX-style evidence, typed tool traces, fail-closed verifier, and SHA-256 manifest checks.

Not claimed: live victim data, endpoint isolation, full disk forensics, or live SIFT workstation execution.